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(TS//SI//REL) New Iranian NERA Satlink Identified 

FROM: 

Chief, Analysis and Target Development Branch, SIGDEV Division, RAINFALL 
Run Date: 11/28/2006 


(TS//SI//REL) Earlier this year, RAINFALL was the source of the 
first noted intercept of an Iranian NERA Satlink network. This 
discovery is significant because it will aid in the development and 
acquisition of tools to help us further exploit this and other TDMA* 
technologies, which are proliferating in areas such as Iraq, Iran, 
and Afghanistan. Users of these technologies include terrorists and 
hostile governments. 

(TS//SI//REL) The Discovery and Analysis of the Iranian 
Signal 

(TS//SI//REL) During general search this April, a RAINFALL 
operator detected a TDMA very small aperture terminal (VSAT) 
system active in Iran. Off-line analysis of the TDMA burst 
recovered bits, frame, and a Unique Word (UW -- used for 
synchronization), leading to the identification of the system as 
NERA Satlink. NERA Satlink, one of the newer TDMA VSAT systems 
that provide low cost broadband Internet access to worldwide 
users, is similar to LINKSTAR and DIRECWAY Internet cafe 
systems that are being used by insurgents and terrorists. 
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(U//FOUO) NERA outdoor unit 

(TS//SI//REL) Analysis of the new signal by the Network Analysis 
Center (NAC/SSG2) and the Digital Communications Technologies 
Branch in CES (S31211) has revealed valuable information. 
Complex analysis of the underlying data showed that the Iranian 
NERA Satlink network was using the MPEG-2/Internet Protocol (IP) 
instead of the asynchronous transfer mode (ATM), which was 
previously noted on signals of this type. In addition, the network 
was identified as digital video broadcasting, return channel via 
satellite (DVB-RCS) compliant. DVB-RCS is the European 
Telecommunications Standards Institute standard for Internet 
traffic over video. These two discoveries will aid in the development 
of a processing solution. 

(U) Some Background 

(TS//SI//REL) In August 2005, RAINFALL had previously detected a 
NERA Satlink that was probably emanating from Jakarta, 

Indonesia. The Indonesian collect was for some time the only 
intercept available for target analysts to analyze and exploit. 
According to the NAC, an Iranian company had purchased 170 
NERA Satlink modems but they remained undetected until 
RAINFALL'S discovery. 

(U) Who Uses the Signal? 

(TS//SI//REL) One user may possibly be the Islamic Republic of 
Iran Broadcasting (IRIB), as geolocations (which are believed to be 
















accurate) placed the signals in the area of the IRIB's Southern 
SATCOM Headquarters building in Tehran. This may also indicate 
that the Iranian government uses NERA VSATs. 


(U//FOUO) NERA block diagram 


(U) Collaboration 


(S//REL) Collaboration and analysis efforts between personnel at 
RAINFALL, NAC, and S31211 are ongoing. In addition, the following 
personnel played a key role in this discovery: 






RAINFA LL Site Systems Engineering Lab 
(former) RAINFALL Search and 
New Deve lopment position operators 

|^^HBHS31211 

Network Analysis Center (SSG2) 


RAINFALL is also working with the GCHQ FORNSAT site SOUNDER, 
trying to match RAINFALL tips with the DVBS hub information that 
they are collecting/processing. 


(U) Conclusion 


(TS//SI//REL) In summary, we believe this is a highly valuable 
mission and intend to continue to pursue further development. 
Given that the users of this technology include our most sought- 
after targets, the potential payoff is great. 


*(U) Note: TDMA = Time Division Multiple Access 


"(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet 
without the consent of S0121 (DL sid comms V 
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